code wiki / (root) / nx_ws_hygiene_core.nx

nx_ws_hygiene_core.nx

buildroot/runtime/nx_ws_hygiene_core.nx

8058 B141 linesdepth 4pulls 4 transitivereach 1 importersview sourcekind librarytopic ws
docsdependenciesstructsconstsfunctions

about

nx_ws_hygiene_core.nx -- importable CORE of the WORKSTREAM HYGIENE classifier (R-ORCH janitorial enforcement, 07-15 operator: "stop having silly things like shell and tsv and non-api bullshit when workstreams are started"). Turns rule 27 (api-first-no-shell) + no-TSV + no-plumbing from DOCTRINE into a MECHANICAL verdict: classify a workstream operation line as SOVEREIGN or a specific VIOLATION. The ONE sanctioned shell use (launch a sovereign build/ship ELF -- rule 27) is exempted BY NAME and short-circuits GREEN; everything else that reaches for shell/TSV/tmp- redirect/raw-plumbing to do workstream work is flagged so it can be reworked onto the API/MCP rails. Pure classifier here (gate-locked); a scanner/linter CLI wraps it. Read-only. license_tier: ORIGINAL

dependencies 2 imports · 1 importers

nx_syscalls.nx nx_crashresume_census_core.nx nx_ws_hygiene_core.nx nx_ws_hygiene_gate.nx

imports: nx_syscalls.nxnx_crashresume_census_core.nx

imported by: nx_ws_hygiene_gate.nx

structs

none

consts

14const HV_NONE: i64 = 0
15const HV_SHELL_CHAIN: i64 = 1 // `sh -c` / `bash -c` glue
16const HV_TMP_REDIRECT: i64 = 2 // `> /tmp/...` / `2>&1` (uncaptured, non-sovereign scratch)
17const HV_TSV: i64 = 3 // .tsv output (should be seg_store)
18const HV_WSL_PATH: i64 = 4 // /mnt/c path (MSYS-mangle-prone) used OUTSIDE the build lane
19const HV_PLUMBING: i64 = 5 // scp/curl/tar/ssh/rsync (should be mgmt API)
20const HV_SHELL_EXEC: i64 = 6 // running a non-build organ .elf via shell (should be tools/call)
21const HV_SHELL_UTIL: i64 = 7 // raw shell PLUMBING as a workstream op: rm -f/-rf (the ACTUAL sin; lock-reaping -> nx_lock_reap)
22const HV_TOKEN_BURN: i64 = 8 // Claude token-heavy one-off tool (WebFetch/WebSearch/Workflow/Agent/Task)
23const HV_ACCEPTED_VCS: i64 = 9 // git add/commit/push = operator-ACCEPTED "git or beyond" VCS -- NOT a violation (sovereign-git = end-state; the sin was the ps|grep|rm plumbing AROUND git, not git)
24const HV_SOV_BUILD: i64 = 10 // sanctioned build/ship lane (rule-27 exception)
25const HV_SOV_API: i64 = 11 // mcp__nishi__ / /api/ / nx_mgmt / tools/call

functions

28func hv_has(hay: *u8, hn: i64, needle: *u8) -> i64
44func hv_is_sanctioned_launcher(line: *u8, n: i64) -> i64
called by 1: hv_classify calls 1: hv_has
51func hv_is_sovereign_api(line: *u8, n: i64) -> i64
called by 1: hv_classify calls 1: hv_has
61func hv_classify(line: *u8, n: i64) -> i64
101func hv_tool_verdict(name: *u8, n: i64) -> i64
called by 1: h_check_tool calls 1: streq_hv
116func streq_hv(a: *u8, b: *u8) -> i64
called by 1: hv_tool_verdict
123func hv_is_violation(v: i64) -> i64
128func hv_name(v: i64) -> *u8
called by 2: h_checkh_check_tool